CNF-14592: add LokiStack configuration CRs to the optional reference section

Add Loki Operator installation and LokiStack log storage CRs for the
telco-core optional logging configuration:

 - LokiStack CR with 1x.extra-small sizing, S3 storage, v13 schema,
   and 5-day retention
 - Loki Operator Namespace, OperatorGroup, Subscription, and
   installation status verification CR (ztp-deploy-wave: 2)
 - S3 object storage Secret template
 - Update ClusterLogForwarder to forward audit and infrastructure
   logs to the local LokiStack via the collector service account
 - Add ClusterLogForwarder-to_amend variant with commented-out
   external forwarding examples

Co-authored-by: Claude

Author: rdiscala

telco-core/configuration/core-baseline.yaml

@@ -47,6 +47,12 @@ policies:
                     status: "True"
                     reason: InstallSucceeded
 
+      # Loki operator (optional component)
+      # - path: reference-crs/optional/logging/LokiOperatorNS.yaml
+      # - path: reference-crs/optional/logging/LokiOperatorGroup.yaml
+      # - path: reference-crs/optional/logging/LokiSubscription.yaml
+      # - path: reference-crs/optional/logging/LokiOperatorStatus.yaml
+
       # Cert-manager operator (optional component)
       # - path: reference-crs/optional/cert-manager/certManagerNS.yaml
       # - path: reference-crs/optional/cert-manager/certManagerOperatorgroup.yaml
@@ -94,6 +100,10 @@ policies:
       - path: reference-crs/optional/logging/ClusterLogServiceAccountAuditBinding.yaml
       - path: reference-crs/optional/logging/ClusterLogServiceAccountInfrastructureBinding.yaml
 
+      # LokiStack log storage (optional component)
+      # - path: reference-crs/optional/logging/LokiSecret.yaml
+      # - path: reference-crs/optional/logging/LokiStack.yaml
+
       - path: reference-crs/required/networking/sriov/SriovOperatorConfig.yaml
         patches:
         - spec:

telco-core/configuration/core-overlay.yaml

@@ -199,6 +199,23 @@ policies:
               outputRefs:
               - kafka-open
 
+      # Cluster Logging with LokiStack (optional - use instead of the above ClusterLogForwarder)
+      # - path: reference-crs/optional/logging/ClusterLogForwarder-LokiStack.yaml
+      #   patches:
+      #   - spec:
+      #       outputs:
+      #       - name: external-logs
+      #         type: "kafka"
+      #         kafka:
+      #           url: '{{hub fromConfigMap "" "regional" (printf "%s-log-url" (index .ManagedClusterLabels "region")) | toLiteral hub}}'
+      #       pipelines:
+      #       - name: infra-audit-to-external
+      #         inputRefs:
+      #         - audit
+      #         - infrastructure
+      #         outputRefs:
+      #         - external-logs
+
       # Metal LB
       - path: reference-crs/required/networking/metallb/metallb.yaml
         patches:

telco-core/configuration/reference-crs/optional/logging/ClusterLogForwarder-LokiStack.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: observability.openshift.io/v1
+kind: ClusterLogForwarder
+metadata:
+  name: instance
+  namespace: openshift-logging
+spec:
+  outputs:
+  - name: loki-local
+    type: lokiStack
+    lokiStack:
+      target:
+        name: logging-loki
+        namespace: openshift-logging
+      authentication:
+        token:
+          from: serviceAccount
+    tls:
+      ca:
+        key: service-ca.crt
+        configMapName: openshift-service-ca.crt
+
+  # - name: external-logs
+  #   type: <external_type>  # e.g., kafka, splunk, syslog
+  #   <external_type>:
+  #     url: <external_url>
+  pipelines:
+  - name: infra-audit-to-local-loki
+    inputRefs:
+    - audit
+    - infrastructure
+    outputRefs:
+    - loki-local
+  # - name: infra-audit-to-external
+  #   inputRefs:
+  #   - audit
+  #   - infrastructure
+  #   outputRefs:
+  #   - external-logs
+  serviceAccount:
+    name: collector
+status:
+  #conditions:
+  #- type: observability.openshift.io/Valid
+  #  status: "True"

telco-core/configuration/reference-crs/optional/logging/LokiOperatorGroup.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: loki-operator
+  namespace: openshift-operators-redhat
+spec:
+  upgradeStrategy: Default

telco-core/configuration/reference-crs/optional/logging/LokiOperatorNS.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openshift-operators-redhat
+  labels:
+    # The cluster-monitoring label ensures Prometheus scrapes this namespace.
+    openshift.io/cluster-monitoring: "true"

telco-core/configuration/reference-crs/optional/logging/LokiOperatorStatus.yaml

@@ -0,0 +1,30 @@
+# Operator installation verification (ztp-deploy-wave: 2)
+# This CR can be used to verify the installation/upgrade of the
+# Loki Operator by including status fields as shown in
+# examples below
+---
+apiVersion: operators.coreos.com/v1
+kind: Operator
+metadata:
+  name: loki-operator.openshift-operators-redhat
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "2"
+status:
+#  components:
+#    refs:
+#    - kind: Subscription
+#      namespace: openshift-operators-redhat
+#      conditions:
+#      - type: CatalogSourcesUnhealthy
+#        status: "False"
+#    - kind: InstallPlan
+#      namespace: openshift-operators-redhat
+#      conditions:
+#      - type: Installed
+#        status: "True"
+#    - kind: ClusterServiceVersion
+#      namespace: openshift-operators-redhat
+#      conditions:
+#      - type: Succeeded
+#        status: "True"
+#        reason: InstallSucceeded

telco-core/configuration/reference-crs/optional/logging/LokiSecret.yaml

@@ -0,0 +1,13 @@
+# Object storage credentials template
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: logging-loki-s3
+  namespace: openshift-logging
+stringData:
+  access_key_id: "<access key>"
+  access_key_secret: "<access key secret>"
+  bucketnames: "<bucket names>"
+  endpoint: "<storage endpoint>" # e.g. <https://storage.endpoint.url>
+  region: "<region>"

telco-core/configuration/reference-crs/optional/logging/LokiStack.yaml

@@ -0,0 +1,29 @@
+# Important: do not reuse the same LokiStack that is used for logging
+# See: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/network_observability/installing-network-observability-operators
+---
+apiVersion: loki.grafana.com/v1
+kind: LokiStack
+metadata:
+  name: logging-loki
+  namespace: openshift-logging
+spec:
+  managementState: Managed
+  limits:
+    global:
+      retention:
+        days: 5 # Default retention period. User-configurable.
+  # Sizing: uses Loki's built-in defaults for PVC sizing, which are determined
+  # by the operator based on the size profile.
+  # Important: sufficient storage must be provided according to data
+  # requirements and the retention period configured above.
+  size: 1x.extra-small # 14 vCPUs, 31Gi memory, 430Gi disk, 100GB/day
+  storage:
+    schemas:
+    - version: v13
+      effectiveDate: "<yyyy>-<mm>-<dd>" # Set to approximately two months before deployment date
+    secret:
+      name: logging-loki-s3
+      type: s3
+  storageClassName: "ocs-storagecluster-ceph-rbd" # Set to the cluster's available StorageClass
+  tenants:
+    mode: openshift-logging

telco-core/configuration/reference-crs/optional/logging/LokiSubscription.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: loki-operator
+  namespace: openshift-operators-redhat
+spec:
+  channel: "stable-6.5" # Adapt for compatibility for OpenShift versions.
+  installPlanApproval: Manual
+  name: loki-operator
+  source: redhat-operators-disconnected # For disconnected environments.
+  sourceNamespace: openshift-marketplace
+status:
+#  state: AtLatestKnown # Expected status